Privacy Policy

1. Information We Collect

Account information: your email address. We use passwordless magic-link sign-in, so we do not collect a password.

Content you provide: the photos you upload and the images and listing copy generated for you. For signed-in users, results are stored for the “My works” gallery.

Usage and technical data: your credit usage and top-up history, and your IP address (used to enforce daily limits for signed-out use). We also process limited technical data needed to operate and secure the Service.

Payment data: payments are processed by Lemon Squeezy as Merchant of Record. We do not collect or store your full card details — we receive only a payment identifier and product information via webhook.

We do not intentionally collect “sensitive” personal information, and we ask that you not upload photos containing identifiable people or sensitive information you are not authorized to share.

2. How We Use Information & Legal Bases

We use personal information to: create and secure your account and sign you in; provide the Service (generate images and copy, store your “My works”); manage your credit balance and free-usage limits; process credit grants and revocations tied to payments and refunds; respond to support requests; comply with law; and detect and prevent abuse.

Where the GDPR/UK GDPR applies, our legal bases are: performance of a contract with you (providing the Service); our legitimate interests (securing the Service, preventing abuse, basic analytics); your consent where required; and compliance with legal obligations.

3. AI Processing

To generate results, the photos you upload are transmitted to our AI provider, Google (Gemini API), and processed to produce images and listing copy. We do not use your private uploaded photos or private generated results to train public third-party foundation models.

4. How We Share Information (Service Providers)

We share personal information only with service providers (processors) that help us run the Service, under contracts that limit their use of the data: Supabase (USA) — database, authentication, and image storage; Google (USA) — AI image and text generation; Lemon Squeezy (USA) — payment processing as Merchant of Record.

We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a business transfer.

5. We Do Not Sell or Share for Advertising

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California law (CCPA/CPRA). We have not done so in the preceding 12 months.

6. International Transfers

We operate from the Republic of Korea and use service providers in the United States, so your personal information may be transferred to and processed in Korea, the United States, and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers. By using the Service, you understand your information may be processed outside your country of residence.

7. Retention & Deletion

Account information and generation history are deleted without undue delay when you delete your account. You can also delete individual results yourself in “My works”.

Signed-out usage-limit records (keyed by IP) are automatically deleted after 7 days. The signed-out free-trial counter is stored only in your browser (localStorage) and is never sent to our servers.

8. Your Rights

Depending on where you live, you may have some or all of the following rights: to access or know what personal information we hold; to correct it; to delete it; to receive a copy (portability); to restrict or object to certain processing; to withdraw consent; and to not be discriminated against for exercising your rights.

California (CCPA/CPRA): you may request to know, delete, and correct your personal information, and to limit the use of sensitive personal information; we do not sell or share personal information. We will respond within 45 days (extendable by a further 45 days where permitted). You may use an authorized agent.

EU/EEA & UK (GDPR): you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local data-protection authority.

To exercise any right, email privacy@nestages.com. We may need to verify your identity before acting on a request.

9. Cookies

We use only cookies and similar storage that are necessary to sign you in and operate the Service (for example, authentication and session). We do not use advertising or cross-site tracking cookies.

10. Children

The Service is intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact privacy@nestages.com and we will delete it.

11. Security

Generated images are kept in private storage accessible only from your own account (row-level security and signed URLs). Payment webhooks are signature-verified, and our database functions are locked down to least privilege. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you and will update the “Last updated” date above.

13. Contact

Controller: Arkmusic, 369 Jijok-ro, Yuseong-gu, Daejeon, Republic of Korea.

Privacy inquiries and data-rights requests: privacy@nestages.com. This policy takes effect on July 12, 2026.